Privacy policy

1. Controller

Ventec Systems GmbH
Carl-Zeiss-Ring 15a
85737 Ismaning
E-mail: info@snackdragon.eu

No data protection officer has been appointed. Data protection enquiries can be sent to the e-mail address stated above.

2. General information

We process personal data only to the extent necessary for the operation, security, communication, order processing, performance of contracts, payment processing, accounting or legal obligations.

Legal bases are in particular Art. 6(1)(b) GDPR for pre-contractual measures and the performance of the contract, Art. 6(1)(c) GDPR for legal obligations and Art. 6(1)(f) GDPR for legitimate interests in a secure and economical operation of the website and the business.

3. Server log files

Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes personal data in the course of operating the website as a technical service provider or processor.

When you visit our website, information is automatically sent to the server of our website. This information is temporarily stored in so-called server log files. The following information may be recorded in the process:

The processing takes place to ensure a smooth connection, for system security, for error analysis and to combat abuse. The legal basis is Art. 6(1)(f) GDPR. The server log files are automatically deleted after 14 days at the latest, unless longer retention is necessary in an individual case to clarify attacks or abuse.

Country detection: When you visit our website, our server determines the country from your IP address using a locally stored DB-IP Lite Country database. We use the country code to show the appropriate country offer, offer the Swiss franc version to visitors from Switzerland, limit financing offers to visitors from Germany, and show a delivery area notice to visitors outside Germany, France, the Netherlands and Switzerland. Your IP address is not sent to DB-IP or another geolocation service for this lookup. The country detection endpoint is excluded from the web server access log; ordinary page requests continue to be logged as described above. Your browser's session storage (sessionStorage) holds a recognised country code and, where applicable, whether you closed the delivery area notice. To select the market, it also holds the last language used in each market and the number and time of automatic redirects. A choice made in the language menu is also stored as a language preference in local browser storage. When an existing basket is transferred between the euro and Swiss markets, session storage holds a copy of its items and, after a successful transfer, a snapshot of the source basket to prevent a duplicate transfer. The original basket remains in the browser's local storage. The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to show offers and delivery information relevant to the visitor's country and to provide reliable market selection. Country data source: IP Geolocation by DB-IP, licensed under CC BY 4.0.

4. Contact, shopping cart and orders

When you contact us by e-mail, use a contact form, place products in the shopping cart or submit an order, we process the data you provide. This may include in particular name, company, billing and delivery address, e-mail address, VAT identification number (USt-IdNr.), ordered products, configurations, payment status and the content of the communication.

The processing takes place for handling your enquiry, checking and fulfilling orders, performing the contract, communicating with customers, delivery, invoicing and complying with legal obligations. Legal bases are Art. 6(1)(b), (c) and (f) GDPR.

To prevent duplicate orders and to allocate payments reliably, we keep a pseudonymised order history. For this purpose, HMAC identifiers are formed on the server side from the e-mail address, where applicable the VAT identification number (USt-IdNr.) and the company name, in combination with the country of delivery and the postcode. The order history contains no contact data in readable form, but in particular the pseudonymous customer allocation, the product ID, the quantity, the order reference, the payment method or booking status and timestamps. Open card or Billie orders processed via Stripe reserve the allocated stock for one hour at most; if the payment is cancelled or the period expires, the reservation is released. To prevent overselling, we also keep on the server side, for each released product ID, a remaining stock and a status for the reservation, booking or release of the respective order quantity. An open order with prepayment holds the allocated stock until performance or a deliberate cancellation; upon a confirmed cancellation it is released again. A retention period of 30 days is provided for released reservation data, 24 hours for orphaned identifiers from unfinished price requests and ten years for booked order histories; after the period expires they are deleted at the next call of the checkout or by the regular server-side clean-up. Legal bases are Art. 6(1)(b) and (f) GDPR; our legitimate interests lie in preventing duplicate orders, preventing overselling and the reliable allocation of payments.

4a. Contact via WhatsApp

Our website contains voluntary links to WhatsApp. Only when you click such a link or send a message yourself do you open the WhatsApp service and is data transmitted to WhatsApp. No WhatsApp tracking module is integrated into the SnackDragon website.

For users in the European Economic Area, WhatsApp is provided by WhatsApp Ireland Limited. When used, WhatsApp processes in particular your mobile number, device and connection data, usage data and the content you send in accordance with its own privacy policy for the European Economic Area. When you write to us via WhatsApp, we process your message and the contact data visible with it for handling your enquiry. Legal bases are Art. 6(1)(b) and (f) GDPR. You can also always contact us by e-mail.

4b. Service requests via the website form

When you use the service form, we process the data you enter for the assessment and handling of your request. This includes name or company, e-mail address, location with country, postcode and town, relationship to SnackDragon, manufacturer and model of the machine, where applicable serial number and year of manufacture, fault category and fault description, information on access and conditions at the location, the preferred contact method, an optional video link and, where applicable, the spare part viewed on the website. A telephone number is optional and only required if you wish to be contacted by telephone or via WhatsApp; it is used exclusively for contact and for arranging appointments in connection with the service case.

You can attach up to three photos of the fault to the form. An uploaded image is completely rewritten on our server and in the process reduced to a side length of at most 2,000 pixels. All additional data of the original file are discarded, in particular location of the shot, time of the shot and camera data; we receive only the image itself. Until the request is submitted, the file is stored under a random name outside the publicly accessible part of our server and is not delivered. On submission it is added as an attachment to the internal service e-mail and deleted from the server; if you cancel the form, it is automatically deleted after 24 hours at the latest. Please upload only images of the machine and no photos in which persons are recognisable.

The data is transmitted to our server in encrypted form and sent exclusively as an internal service e-mail to info@snackdragon.eu. Website and mailbox are operated via Hetzner Online GmbH. The form does not create an additional database of case data; attached photos are processed solely as described in the preceding paragraph. To protect against abuse, the server stores, within a short time window, only access times under an IP identifier pseudonymised with a secret key; outdated rate-limit data is cleaned up on the server side.

Legal bases are Art. 6(1)(b) GDPR for pre-contractual and contractual service requests and Art. 6(1)(f) GDPR for secure, verifiable handling and for combating abuse. We keep service requests and the related communication for as long as necessary for handling and for possible legal claims; afterwards they are deleted, unless statutory retention obligations preclude this. Before case data is passed on to a service company, we name the specific company to you and ask for your consent.

5. Payment and invoice processing

Depending on the payment method chosen, we process payment and invoice related data in order to allocate payments, issue invoices, manage receivables and comply with statutory retention obligations.

For online payments in the shop we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Stripe receives the data required for payment processing, for example name, e-mail address, payment data and amount. The processing takes place for the performance of the contract (Art. 6(1)(b) GDPR). A transfer to Stripe, Inc. in the USA may take place in the process; Stripe is certified under the EU-US Data Privacy Framework, and standard contractual clauses additionally apply. More information: https://stripe.com/nl/privacy

For purchase on invoice via Billie, the order and company data needed for the offer, the identity, company and creditworthiness check and the payment processing via Stripe are passed on to Billie GmbH, Am Postbahnhof 15, 10243 Berlin. Billie decides on approval under its own responsibility and processes the data for the performance of the purchase on invoice, for fraud prevention and for receivables management. The legal basis for our transfer is Art. 6(1)(b) GDPR. More information: Billie privacy provisions.

Insofar as payment, accounting, invoicing or shipping service providers are engaged, they receive only the data necessary for the respective service. Legal bases are Art. 6(1)(b) and (c) GDPR and Art. 6(1)(f) GDPR.

5a. Financing requests

When you request financing via our website, we process the data you provide, in particular name, company, contact details, the desired machine with configuration and net price and the desired term.

If we forward your financing enquiry for assessment, a financing intermediary based in Germany that we engage for business financing receives the enquiry data needed for that assessment. The intermediary handles the enquiry and may pass it to participating financing companies. It acts as an independent controller for its own processing under the GDPR. Any financing agreement is concluded between you and the relevant financing company, not with us or the intermediary.

Further documents may be required for a creditworthiness check, such as proof of business registration, proof of income or a self-disclosure form. The intermediary will tell you, where applicable, which documents are needed and how to submit them. These documents cannot be submitted through our website enquiry form. If they are made available through the intermediary’s platform, the financing company involved and the supplier you enquired with may have access for purposes of the particular financing case.

The legal basis is Art. 6(1)(b) GDPR, as the transfer is necessary for carrying out the pre-contractual measures you requested. There is no obligation to submit a request; you can also purchase our machines without financing.

5b. Availability notification and discount code

As long as a product cannot be ordered, you can enter your e-mail address on the product page to receive a notification as soon as ordering becomes possible. Your e-mail address, the machine concerned and the configuration with net price selected on the product page are processed in the process.

We use this data for the requested notification about the availability of this product. When you request a discount code on the product page, we additionally send you the model-specific code by e-mail. No newsletter or further advertising results from this; for that we would ask for your consent separately. The registration reaches us as an e-mail to info@snackdragon.eu and is not stored in a separate mailing list. When the code is redeemed, we store its identifier and redemption status together with the order to ensure the correct calculation of the discount.

The legal basis is Art. 6(1)(b) GDPR for the pre-contractual measure you requested and Art. 6(1)(f) GDPR with regard to answering your request. Providing the data is voluntary; you can always write to us directly by e-mail instead. We delete the data as soon as the notification has been sent and no statutory retention obligations prevent this.

6. Recipients of personal data

Personal data may be passed on to technical service providers, in particular our hosting provider Hetzner Online GmbH, shipping and forwarding service providers, payment and invoicing service providers, tax advisers, authorities or other recipients, insofar as this is necessary for the operation of the website, the performance of the contract, payment processing, delivery, accounting, legal enforcement or legal obligations.

7. Retention period

We keep personal data only as long as necessary for the purposes stated or as long as statutory retention periods apply. Business documents relevant under commercial and tax law may be kept for up to ten years. Communication data is deleted when it is no longer needed for handling and no legal obligations prevent this.

8. Cookies and local storage

Our website uses third-party web analytics and advertising services only with your consent; details on Google Ads conversion measurement can be found in section 8a. Our own product and order statistics likewise take place only with your consent; details can be found in section 8b. Insofar as Google Customer Reviews is activated, the order confirmation page loads the opt-in module described there only after your express choice “Show Google survey”. Google may use cookies, pixels or similar technologies in the process. The legal basis for loading and for access to or storage of information on your terminal device is your consent under Section 25(1) of the German TDDDG.

For technically necessary functions, information may be stored in the browser, for example the contents of the shopping cart, the language selection or states of the user interface. This storage serves to provide expressly requested website functions and takes place under Section 25(2) of the German TDDDG and Art. 6(1)(f) GDPR.

When you select Google Ads in the cookie notice and save your choice or choose “Accept all”, we use Google services for measuring reach and advertising success (Google Ads Conversion Tracking). The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In the process, cookies are set or information is stored or read on your terminal device, and usage data is processed, including the shortened IP address, page views and conversion events such as orders or requests. We do not pass names, e-mail addresses or other contact data in readable form to Google.

We use Google Consent Mode v2. Without your consent to Google Ads, all four consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) are set to “denied” and no Google tag is loaded; no tracking cookies are then set. The Google tag is loaded only after your consent to Google Ads via the saved choice or “Accept all”. The legal basis for setting and reading cookies or information on your terminal device and for the subsequent data processing is your consent under Section 25(1) of the German TDDDG and Art. 6(1)(a) GDPR.

With the same choice, we additionally record on our own server whether a visit to our website with a Google Ads click parameter took place before an order. For this we store our own cookie and pseudonymous identifiers and link the origin information to your orders. We do not store the values of the click parameters for this allocation; the allocation is not passed on to Google. Cookie and order allocation apply for 30 days at most from registration and are not extended by further visits or orders. A technical safeguard of the withdrawal may exist for up to 30 days after the withdrawal, so that delayed requests do not reactivate the consent. After withdrawal we no longer use the allocation and delete the associated links through the secured clean-up. The processing is voluntary and not required for a purchase.

A transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses may additionally apply. More information can be found in the Google privacy policy and the Google information on international data transfers.

You can withdraw your consent to Google Ads at any time with effect for the future via the link “Cookie settings” in the footer of the page. When consent to Google Ads is withdrawn, all four consent signals are immediately set to “denied” and no further events are sent to Google. The retention period of the cookies set by Google and the data processed depends on the data type, the purpose and the account settings; Google describes details under Retention periods at Google.

8b. Own product and order statistics (with consent only)

With your express consent in the cookie notice, we count product views, successful additions to the shopping cart, the opening of the order form and of the order overview, as well as errors in input validation, in price requests and in order attempts. This shows us at which points the purchasing process can be improved. The reports go exclusively to our own server and are not passed on to Google for these statistics.

We store only daily counters per product and action and, in the case of errors, where applicable additionally a fixed, predefined technical error category. The statistics contain no names, contact data, form input, order numbers, IP addresses, session IDs or advertising click IDs. We do not store individual usage paths and do not create visitor profiles. The connection data and server log files that arise during technical server operation are processed separately from this in accordance with section 3.

The analysis covers the last 90 days; older daily values are deleted at the next retrieval of the statistics. Participation is voluntary and not required for a purchase. Without your consent we send no reports for these statistics. You can withdraw your consent at any time via “Cookie settings” with effect for the future. Legal bases are Art. 6(1)(a) GDPR and, insofar as information is stored or read on your terminal device, Section 25(1) of the German TDDDG.

9. Location radar

When you use the location radar, we process the business location address you enter in order to analyse the surroundings of a possible machine location. Please do not enter a private address or confidential location data. The check begins only after you have expressly consented to the transfer of the address to Google Maps and of the coordinates determined from it to FOSSGIS.

To determine the coordinates, our server passes the address to the Google Geocoding API. Google processes in particular the search query and technical data of the requesting SnackDragon server. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For this processing, Google and Ventec Systems GmbH each act as independent controllers under the EEA terms of Google Maps Platform. Google may process data on servers outside your country. More information can be found in the Google privacy policy and the EEA terms of Google Maps Platform. The legal basis for the transfer of the address is your consent under Art. 6(1)(a) GDPR; you can withdraw it with effect for the future.

Our server then retrieves mapped surroundings data on the basis of the coordinates via Overpass servers of FOSSGIS e.V. The coordinates, but not the address entered or the IP address of your browser, are passed on to FOSSGIS. The legal basis for the transfer of the coordinates is likewise your consent under Art. 6(1)(a) GDPR. The German assessment is then prepared on our server according to fixed rules. Neither the address nor coordinates or derived location data are passed on to OpenAI in the process. More information can be found in the FOSSGIS terms of use.

We do not store the address entered and the exact coordinates permanently. An analysis result derived from the position, without address and coordinates, may be buffered for 15 minutes at most in a temporary server folder protected against access, in order not to repeat identical requests unnecessarily. To protect against abuse, we store a hash formed from the requesting IP address and a timestamp for 24 hours at most. Legal bases for the location check carried out at your request and the protection against abuse are Art. 6(1)(b) and (f) GDPR.

10. Google Customer Reviews

Google Customer Reviews is activated.

After an eligible order, the order confirmation page may show a voluntary prior choice for Google Customer Reviews. Before your choice, no connection to the Google module is established and no order data is passed on to Google. Only when you choose “Show Google survey” do we load the official Google opt-in module and pass the order number, the e-mail address, the country of delivery and the expected delivery date to Google. Google may use cookies, pixels or similar technologies in the process. In the Google module then displayed, you decide whether Google may send you a review survey by e-mail after the expected delivery date. “Do not participate” has no disadvantages for your order.

The legal basis for loading the module, the transfer of the order data and the possible access to your terminal device is your consent under Art. 6(1)(a) GDPR and Section 25(1) of the German TDDDG. You can withdraw consent with effect for the future; the lawfulness of the processing already carried out remains unaffected.

Before the Google module is loaded, we record, to document your choice, only the order number, the version of the consent text, the language and the time. No additional e-mail address or IP address is stored for this. The legal basis for this proof of consent is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. After the end of the third calendar year following the consent, the proof is automatically deleted at the next consent action, unless it is exceptionally needed longer for the establishment, exercise or defence of a legal claim.

To protect public checkout, payment and consent endpoints against automated mass requests, we store in a temporary server folder an identifier of the requesting IP address, pseudonymised on the server side with a secret HMAC key, and the times of the calls. For the limitation, the system takes into account only the respectively configured short time window, usually the last hour; outdated entries are deleted at subsequent secured calls and additionally by the regular clean-up of temporary server files. For the location check, the IP hash described in section 9 applies instead, which is kept for 24 hours at most. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the protection of order, payment, consent and location requests against abuse.

The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google and Ventec Systems GmbH process the data, under the terms applicable to Google Customer Reviews, each under their own responsibility. Processing by Google LLC in the USA or in other third countries is possible. Google LLC is certified under the EU-US Data Privacy Framework; Google also names other applicable transfer mechanisms. More information can be found in the Google privacy policy and in the Google information on international data transfers.

The data set prepared for the opt-in is stored in your browser only for the duration of the session and for 24 hours at most. It is deleted upon refusal, upon cancellation of the payment, upon an invalid reconciliation of payment or order and immediately upon the attempt to load the Google module after your consent. Google keeps transmitted data for different lengths of time depending on the data type, the purpose and the account settings; some data is automatically deleted or anonymised, other data may be kept longer for security, abuse prevention or legal obligations. Google describes details under Retention periods at Google.

10a. Direct marketing by post to businesses

To initiate business relationships we send addressed advertising mail to companies, institutions and public authorities. The addresses used for this come exclusively from publicly accessible sources, in particular company websites, the commercial register and industry and location directories. The company name, the address, the industry and, insofar as publicly stated, the job title or the name of a person authorised to represent are processed. Private individuals are not contacted.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in direct marketing aimed at business recipients; recital 47 of the GDPR expressly names processing for direct marketing purposes as a legitimate interest. Insofar as the addresses used are personal data and we have not collected the data from you yourself, we inform you of this in accordance with Art. 14 GDPR at the latest with the first mailing.

We keep this data as long as it is needed for the approach, but at the latest until three years after the last contact. If you object to the advertising, we store your address permanently in a blocking list to reliably prevent further mailings; this continued storage serves exclusively to implement your objection.

You can object at any time and without giving reasons to the processing of your data for direct marketing (Art. 21(2) GDPR). An informal message to info@snackdragon.eu is sufficient; afterwards you will no longer be contacted for advertising purposes.

11. Your rights

You have the following rights towards us with regard to the personal data concerning you:

To exercise your rights, you can contact: info@snackdragon.eu

You also have the right to lodge a complaint with a data protection supervisory authority.

12. SSL encryption

For security reasons, our website uses SSL encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.

13. Currency and amendment of this privacy policy

This privacy policy is currently valid and dated 8 September 2026. Due to the further development of our website or because of changed legal provisions, an amendment of this privacy policy may become necessary.

Updated: 8 September 2026